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MEMORANDUM FOR: Director of Security 


FROM 


SUBJECT 


REFERENCES 


Clifford D. May , Jr. 

Director of Data Processing 

Computerised Database - Area3 Approved ; 
Storage of Collateral and SCI Material 


25X1 


a. Memo to D/O DP fm D/OS dtd 27 Jan. 77, 
same subject. 

b. Memo to D/OS fm D/QDP dtd 25 Feb. 77, 
same subject. 


My previous memorandum (reference b.) stated 
that Jun< b irrm vi a s the earliest date that ODP would have 
personnel available to wort on your request. However, an 
analyst from B Division of A pplications is now avai lable to 
begin work on this proj ect. 

Division, has contacted [ 


„ .Chief, 3 25X1 A 

Jof the Special 25X1 A 


Security Center to begin a preliminary study of your require- 
ments . 


After analysing the requirements of the proposed 

Storage Facilities system wa have concluded that we could 
readily implement it using OOP's central computers. However, 
a significant resource commitment is required to collect the 
necessary data and enter it into the data base. V7e have pre- 
pared an analysis of the data collection and preparation tasks 
and recommended procedures to obtain the data necessary for 
the system. These are contained in the attached study. 


Because there is a significant resource commit- 
ment required of Security, ODP , and other Agency components, 

I recommend that | ~| coordinate the review of this 

study with those people identified in paragraph 1. of the 
attachment. Before you and I apx>rove ODP's continuing with 
the system development, we should be certain that we agree 
with the findings and recommendations of the attached study. 

If you concur v/ith the study’s recommendations and want ODP 
to continue work on the schedule provided in the study, please 
sign below. 
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CONCUR: 


Director of Security 


Date 


cc: C/BD/ODP 
C/AS/ODP 
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STORAGE FACILITIES DATA BASE 
(STORFAC ) STUDY REPORT 


References: (1) 


Memo fr CD/ODP 

subject- Requirements Def i nUi gn 
Storage Facility Data Base 


dtd 16 Nov 7"^5X1A 
for 

25X1 


(2) Memo fr Chief, Compartmented' Information 
Branch, DD/Pf<M/OS, dtd 15 Jan 77, subject: 
Top Level Remri reme nts for Storage Facility 


Data Base 


25X1 


1 . 


Kgency personnel 


who have an interest 


in the 


Storage Facilities Data Base Concept presented in References 


1 and 2, met during the month of December 3.977. The fol 3. owing* 
inidividuals were present: 


- C/CIB/SSC/OS 

- ISB/PSD/OS 

- OD&E Security Staff 

- OD&E Security Staff 

- OL Security Staff 

- C/BD/ODP 

- CD/ODP 

- C/SMS/DDS&T 

- NFAC Security Staff 

- CSD/OC 

- C/ISSG/OS 


The references had been studied prior to the meeting. The 
data base concept was thoroughly discussed. The final outcome 
of the meeting was a general concurrence that such a system 
is needed, general agreement on the types of data which should 
be collected and maintained, and satisfaction with the formats 
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and frequencies of the reports which should be produced. The 

i 

elements which would be needed to support the system are listed 
in Reference 1. Report formats are detailed in Reference 2. 

2. The general consensus was that a system was 

needed to inventory and monitor secure storage facilities. 

It was questioned, however, whether the development should 

proceed at this time, since the Agency is currently performing 

other studies related to industrial security practices. It 

» 

was decided that ODP should expend sufficient effort to investi- 
gate the following: 

° Where is all the data which is needed for data 
base generation currently located? 

° How can this information be gathered and reduced 
to machine readable format? 

° What input media should be used (cards, CAMBXEC, 
etc) ? 

° What are the STORFAC development costs? 

° How. long will it take to develop such a system? 

The paragraphs which follow address these questions and con- 
tain the findings of this short study effort. 

3. Data which is needed to generate a Storage 
Facilities file is stored in several offices at various loca- 
tions. Some of the data sources will be relatively easy 


2 


Approved For Release 2002/0§fbii^6lA-kt)P96BQ'jl72R000900020007-5 




.t 


25X1 


Approved For Release 2002/05/1 


C >r ' N' r 3 r* r \ t a 5 

i/07 i : i e(A-RbP8Wd<'»?iR00Q90D020007- 


to research. Some of the data is stored in voluminous 
folders and will require considerable effort and some source 
familiarity in order to extract the required information. 

The primary offices which currently maintain most of the 
required information are: 

“ Office of Security (OS) 

“ Special Security Center (SSC) 

Information Systems Security Group (ISSG) 

~ Physical Security Division (PSD) 

- Industrial Security Branch (ISB) ■ 

" Overseas Security Branch (OSSB) 

- Domestic Security Branch (DSB) 

“ Technical Security Division (TSD) 

Office of Logistics (OL) , Security Staff 
- Office. of Communications (OC) 

Communications Security Division (CSD) 


25X1 A 


Additional data sources may be identified as the development 
effort progresses. 

nformation on approximately 1,200 active storage 


i i * * j w w Qouivc sror 

locations is maintained in (ssc) This information is logged 

and maintained on manual records (5 x 7 index cards). Each 

card contains data for one location. Data values on the 

index cards are labeled and, therefore, would be relatively 

ea.,y t.o extract.. I he following information is normally 


rr-'A 
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available on each facility index card: 


° Facility Name 
° Activity Indicator 
° Facility Location 
0 Cover ; 

SPECLE Number (assigned by SSC) 

° Agency Interest' 

° Security Officer w/telephone number 
0 Alternate Security Office w/telephone number 

Responsible Agency, Component, Division, Contract Team 
Type of Operation . - 

° Facility Clearance Level 
° Accreditation Date 
° Special Activities 
° Associated SCI Projects 
° Comments 


Security Stati c) maintciins approximately 
1,900 contract folders. About 600 of these folders are main- 
tained for active contracts/contractors. The folders contain 


all the information concerning the contract that a vendor has 


with. the Agency. In addition, the folder has information 
regarding the contractor facility in which classified informa- 
tion is stored and/or produced. These folders are for facili- 
ties which may or may not be the same as those facility index 
cards maintained by SSC. Detailed examination of these folders 
would normally yield the following data items: 


° Facility Name 
° Facility Location 
° Clearance Level 
° Sterility Code 

o Security Officer w/telephone number 

Alternace Security Officer w/telephone number 
Security Survey Date (s) 

Component/Division/Team Responsible for the Facility 
Extraction of the data from the OL Security Staff contract 
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the researcher had a limited familiarity with the contents of 
the folder. This is primarily due to the quantity of data 
stored for a particular contract. 

6. The ^TTS/PSP ) maintains folders on approximately 


[ 


active stations located around the world. Information for 


most of the facilities (stations) maintained by PSD is also 
located on the 5x7 index cards kept by SSC.' In addition to 
data which describes and locates a station, the folders 
identify storage type, cover and type of operation. Also, 
they specify the historical security survey and security audit, 
dates which are required for development of 5T0RFAC. These 
folders contain a considerable volume of data and would require 
some degree of familiarity with the contents in order to re- 
search and retrieve the necessary historical information. 

7. 


The OC, CSD and 


officers maintain data 


25X1 A 


for installations on which a COMSEC or TEMPEST survey is to 

be or has been conducted. Information on COMSEC and TEMPEST 25X1 A 


surveys is maintained and readily accessible in CSD and 
on chronological lists which identify the facility and specify 
the latest survey dates. 

8 . 


OS/ISSG maintains a data file which contains 
records on approximately ! I computer facilities. These 
computer areas are primarily located at contractor facilities. 
Information in this data file consists of the following: 
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° Fcicility Name 
° Facility Location 
° Clearance Level 

° Responsible Component/Division/etc . 

° Date of Icitest computer Facility Inspection 
0 Identification of the types of Computing Equipment 
w/ vendor 

This data is processed periodically to produce tabular reports 
in several different sequences (Location, Facility Name, etc.) 
It would be relatively easy to research and extract data for 
inclusion in the STORFAC data base. 

TSD maintains information concerning the 


9. 


dates on which an ACM survey was conducted at a specific facility 
This information is readily available for extraction and 
inclusion in the STORFAC. data base. 

10 . 


[‘he primary problem which must be sol ved in 
order to develop the STORFAC data base is how to collect, 
edit, collate, and enter the information which is available 
at the various sources. A procedure must be developed which 
will either (1) allow all available data to be collected, 
collated and edited for each unique facility prior to intro- 
duction to the data base; or (2) allow for incremental develop 
ment. After considering both approaches, it is suggested 
that the second approach be considered for the development 
effort. An incremental approach would allow for development 
of a partial data base which would contain partially complete 
records. Subsequent operations would supply additional facili 
ties not currently included in the SSC files and provide the 
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records complete. Figure 1, pages 1 through 7 is a flow 
diagram of the suggested approach. 

11 . 


Kny attempt to assemble all the necessary infor- 


mation prior to data base generation would require a signifi- 
cant redundant effort to code information at the various data 
source locations. In addition, it would place a tremendous 
burden upon SSC to collate all the data for a unique. facility 
prior to its introduction to the data base. 
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in the SBC of the Office of Security. Data from each of the 
1,200 index cards would be examined. Data items required in 
the STORFAC data base which are available in SSC would be 
entered on a Delta Data terminal using a CAMEXEC menu. Figure 
2 is a copy of the menu which identifies those data items 
input by SBC. Edit routines would be invoked, where applicable 
to ensure that the data entered conformed to acceptable formats 
ranges and values prescribed by SSC. After the data passes 
the applicable edits, it will be stored in a transaction disk 
file. Periodically (perhaps once or twice a week) , the trans- 
action data would be batched into a job stream which would 


invoke the File Maintenance (FM) module of NIPS. This trans- 
action information would be used to generate (first time) or 
add to the STORFAC data base. 

13. | | After each FM process, SSC would be provided 


with an audit trail report which would consist of a formatted 
dump of the content of each STORFAC facility record which was 
added to the file or changed in any way during the FM run. 
This activity would continue until data from all 1,200 index 
cards had been extracted and entered into the file. At this 


point in time, a partially complete STORFAC data base would 
be available for processing by SSC. However, this file would 
only contain partially completed data records. The other 
information needed to make each facility record complete re- 
sides in the other offices identified in paragraph 1 of this 
report . 
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14. | | In order to -continue the incremental develop- 


ment effort, the data residing in the STORFAC data base would 
be extracted , sorted and processed to produce a master report 
similar in appearance to the CAMEXEC menu used for data intro- 
duction. The sequence of this report would be in facility 
name order. Only data for one facility would appear on each 
printed page of the report. At the same time, one line per 
facility cross index listings would be produced to assist 
the other offices who will be contributing data in their 
facility research and identification activities. The cross 
indices could be provided in facility location by State, 

SPECLE Number, etc. orders, as considered necessary for 
identification purposes. The master report format would con- 
tain all of the known (previously entered by SSC) data together 
with sufficiently labeled space for that information not 
currently in the data base. 

A quantity of blank forms similar to the 


■15. 


CAMEXEC menu v.'puld be produced for use by the offices other 
than SSC, to enter data for facilities not currently resident 
in the STORFAC data base. These forms would have space for 
all the required data fields with labels for data entry. 

The master report, cross index reports and 


16. 


a supply of blank menu forms would then be forwarded to the 
OL Security Staff for their inputs. 


17 
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must be researched in OL . If the folder is for a facility 
already in the STORFAC data base, additional items of informa- 
tion (dates, etc.) must be extracted and entered in the appro- 
priate space on the partially complete master report pcige for 
that facility. If the folder is for a facility not currently 
in the STORFAC data base, one of the blank forms must be com- 
pleted. All applicable data in the folder must be extracted 
and entered. Figure 3 identifies those data values which 
would be supplied by the OL Security Staff folder research 
effort. 

18.1 when all 600 contract folders have been 


researched, the partially completed forms, the blank menus 
and the cross index listings will be forwarded to Physical 
Security. The records in PSD would be researched, data ex- 
tracted and entered on the forms in the same manner as the 
process accomplished in OL. (Figure 4 identifies those data 
values which would be supplied by the PSD folder research 
effort.) -When all PS facility records have been exhausted, 
the forms and index reports will be forwarded to TSD where the 


process is repeated (Supply ACM dates for existing STORFAC 
records, create new forms for previously not identified facili- 
ties.). When. the TSD activity has been completed, the entire 
package will be passed to ISSG for their data extraction process 
When the ISSG extraction effort is finished, the package is 


18 
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is repeated. When complete, OC v?ill return the entire package 
to SSC . (Figure 5 identifies those data values which would be 
supplied by TSD; Figure 6 identifies those data values supplied 
by ISSG; and Figure 7 identifies the data values supplied by 


OC/CSD and 
19. 


Upon receipt of the package from OC, the final 
stage of incremental development can begin. Each facility form 
must be examined to determine if it is a new facility (not one 


of the original 1,200 SSC records) or if it is one of the 


original SSC facilities. If it is a form for a new facility, 
SSC must determine its SPECLE Number and assign a machine 
reference number (MRN) . Since the MRN is the record control 
element for STORFAC, care must be exercised to ensure that 
this’ MRN is unique from all others. When these two data 
fields have been completed, the information can be entered via 
the CAMEXEC menu and transactions created and stored on the 
transaction file. 


20. I Ilf the form is for one of the original 1,200 

facilities, the data added by OL, PSD, ISSG, TSD, and OC would 
be entered via the CAMEXEC menu and stored with the transactions 
produced in the previous step. When all information has been 
entered, the transaction data would be batched into an FM job 


stream and the STORFAC file updated. At this point, SSC should 
be in control of a complete Storage Facilities Data Base. It 
is suggested that Master Format Reports be produced for each 


21 
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new facilities identified' and errors found in the data base, 
blank forms similar to the CAMEXEC menu can be used to forward 
new or changing information to SSC for inclusion in the data 


base . 

2 i. The previous paragraphs briefly describe a 

suggested process which could be used to incrementally develop 
the STORFAC data base. The pages which follow estimate the 
costs for this effort. Costs are identified for Agency re- 
search and entry effort in working days, software development 


in working days and machine costs in terms of computer usage 

and terminal hook-up costs. 

22. The cost for the ongoing File Maintenance 


activities which will be required to keep STORFAC current are 


difficult to determine. It is estimated that the data base 
would normally be updated on a weekly basis. This process 
would be required to enter data for new facilities and update 
information on existing facilities. In addition, it is assumed 
that there would be approximately 2 report production runs 
per week. Each File Maintenance run will require approximately 
1 minute CPU time at a cost of $22 per run. Each report pro 
ducti.on run will require approximately .5 minute CPU time at 
a cost of $11 per run. Computer usage costs will be billed to 
OOP. The cost for data extraction and terminal entry will 
depend upon the amount of activity associated with introduction 


25 
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of now secure facilities .and the number of surveys/inspections 

performed by the various teams and offices. Terminal hook-up 
time for entry of a new facility will be in the range of 5 to 
10 minutes. Hook-up time for entering new data on an existing 
facility wall depend upon the amount of data being added. This 
should not exceed more than 5 minutes per facility. 

The pages which follow provide an estimate for 


23. 


the various costs associated with STORFAC development. Figure 
8 presents the estimate for programmer effort associated with 
software development which would be charged to the ODP budget. 
Figure 9 provides an estimate of the machine costs for software 
and data base development activities which would be charged to 
the ODP budget. Figure 10 is an estimate of the number of 
work days which would be required to extract and enter the 
data via a terminal using a CAMEXEC menu. Figure 11 is a 

schedule for STORFAC development in terms of calendar weeks 
per task. 


2 6 

Approved For Release 2002/05/07 ; : CIA^DP96B01172R000900020007-5 

VU • '* J i..' t t j t 1 I • 




rAH£iF>M%nl AJ 

• vU i 5 I \ J l . . i i » / v ^ 

Approved For R#ta«se 2002/05/07 : CIA-RDP96BO1172R}j069OOO2OOO7-5 

r , PROGRAMMER 

Software Development Cost Estimates 


CAMEXEC MENU W/EDITS 

NIPS FILE ANALYSIS & DESIGN 

FILE MAINTENANCE LOGIC 
(Design, Code, Test) 

SSC DESIGNED REPORTS (6) 

AUDIT TRAIL REPORT 

DUPLICATION OF CAMEXEC MENU REPORT 
CROSS INDEX REPORT 
FILE GENERATION £>• TEST 
NIPS SOFTWARE DOCUMENTATION 
USER TRAINING & MONITORING 
COVERSION TABLES 


22 work days 
10 
15 


15 

2 

2 

1 

5 

10 


TOTAL 


89 work days 


Note: This translates into approximately $10,800 

@ $600 per work week. 

(18 wk x $600 = $10,800) 


Figure 8. Programmer Software Development Cost Estimates 
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MACHINE COST ESTIMATES 


SOFTWARE DEVELOPMENT COMPUTER COST $1,300 

(approx. 1 hour CPU time) 

SOFTWARE DEVELOPMENT TERMINAL HOOK-UP COST $2,400 

(approx. 200 hours @ $12 hour) 

COMPUTER COST FOR FILE GENERATION & $ 650 

REPORT PRODUCTION DURING INCREMENTAL 

DEVELOPMENT 

(approx. .5 hour CPU time) 

TERMINAL HOOK-UP TIME FOR SSC DATA ENTRY $3,840 

DURING INCREMENTAL DEVELOPMENT 
(75 facilities per day = 320 

hours at $12 per hook-up hour) 


TOTAL MACHINE COST 


$8,190 


Figure 9. Machine Cost Estimates 
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DATA -EXTRA C TION COSTS IN 

TERMS O F WORKING DAYS 


SSC ORIGINAL DATA EXTRACTION & 
CAMEXEC ENTRY TIME 


OL DATA EXTRACTION 
PSD DATA EXTRACTION 


TSD DATA EXTRACTION 
ISSG DATA EXTRACTION 

DATA EXTRACTION 


OC/CSD 


SSC CAMEXEC ENTRY OF NEW 
FACILITIES & ADDITIONAL DATA 


20-25 person work davs 


20-30 

20-30 

10-15 

10-15 

10-15 

20-25 


!» |f 

»» II 

*F ft 

w n 

it n 

*» . ft 


TOTAL 


110-155 person work days 


Note: If records must be researched in other offices, the 

data extraction work day costs must be increased 
proportionately. 


Figure 10. Data Extraction Cost Estimate: 
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